Bawbel Scanner MCP Server

The only open-source scanner that produces OWASP AIVSS scores for MCP servers and skill files. Never executes code. It runs locally over stdio via the published package.

People connecting security tools to Claude, Cursor, VS Code, or another MCP client. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-07-05 · ★ 10 · #76 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

NOASSERTION · Python servers · how we verify → /methodology

01 · Install Bawbel Scanner

before you install - you'll need

Set BAWBEL_SANDBOX_ENABLED, BAWBEL_SANDBOX_IMAGE before connecting.

Claude Code

claude mcp add bawbel-bawbel-scanner -- uvx bawbel-scanner

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "bawbel-bawbel-scanner": {
      "command": "uvx",
      "args": [
        "bawbel-scanner"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license no standard license detected - usage rights unclear; check the repo before commercial use

pypi package bawbel-scanner - check the name against the project README before installing (PyPI has no namespace ownership)

registry namespace io.github.bawbel is GitHub-verified and matches the repo owner

03 · What Bawbel Scanner can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

Latest releases

v1.3.0 · 2026-06-27

What's new in v1.3.0 · Confidence and evidence metadata on every finding · Every Finding now carries four evidence fields populated at detection time: · | Field | What it tells you | · |---|---| · | confidence |…

v1.2.3 · 2026-05-23

Added  to README.md so the · official MCP Registry at registry.modelcontextprotocol.io can verify PyPI · package ownership. · No functional changes. Scanner behaviour…

v1.2.2 · 2026-05-20

What's fixed · Unknown file profile over-suppression (B1) · Files outside recognized paths (docs/, examples/) were classified as · unknown and assigned a confidence threshold of 0.80 - higher than the · skill threshold…

04 · Who maintains Bawbel Scanner

Bawbel Scanner is maintained by bawbel. We track 3 MCP servers from bawbel - 3 actively maintained, 21 combined GitHub stars, oldest repo from Apr 2026.

05 · Facts

repository: github.com/bawbel/bawbel-scanner
category: security - ranked #76 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 1 release in the last 90 days (latest 2026-06-27)
registry: io.github.bawbel/bawbel-scanner (active, first published 2026-05-06)
packages: pypi:bawbel-scanner

06 · Bawbel Scanner FAQ

What is Bawbel Scanner?

The only open-source scanner that produces OWASP AIVSS scores for MCP servers and skill files. Never executes code. It runs locally over stdio via the published package.

Is Bawbel Scanner still maintained?

Yes - as of 2026-08-25, its last commit was 2026-07-05 and it shipped 1 release in the last 90 days. We re-verify nightly.

How do I install Bawbel Scanner?

Run `uvx bawbel-scanner`. The README documents 2 environment variables (BAWBEL_SANDBOX_ENABLED, BAWBEL_SANDBOX_IMAGE) to set first. Set BAWBEL_SANDBOX_ENABLED, BAWBEL_SANDBOX_IMAGE before connecting. You can also paste the ready-made client config above.

Does Bawbel Scanner run locally?

Yes - it's a stdio server: it runs on your machine (via uvx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Bawbel Scanner

Alternatives to Bawbel Scanner

Maintained security servers if Bawbel Scanner isn't the fit.

Pairs well with

Servers that cover what Bawbel Scanner doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Mcpwall · FAOSTAT MCP · Whoop MCP (briangaoo) · Shodan · Virustotal

More Python MCP servers · Agentfetch · Beever Atlas · OpenSTAAD MCP Server · Genefoundry · see all